Inspect and recover SSH private-key access

Needs: Correct key format, passphrase if encrypted, matching server account/key authorization and accepted algorithm/policy

Shell commands

# Baseline
ssh2john id_rsa > ssh.hash
john --wordlist=wordlist.txt ssh.hash
john --show ssh.hash
chmod 600 id_rsa
ssh-keygen -y -f id_rsa > derived.pub
ssh -vv -i id_rsa -o IdentitiesOnly=yes -p PORT USER@TARGET

# Hashcat variant — only for a supported OpenSSH format
hashcat -hh | grep -i 'OpenSSH\|Private Key'
hashcat -a 0 -m MODE ssh.hash wordlist.txt -r RULE_FILE

Choose MODE from the complete $sshng$... structure and installed help. Token-length or unsupported-cipher errors require a compatible parser/tool, not --force with a wrong mode.

Verify → Verify the key parses and an SSH authentication/session succeeds under the correct target identity.

If it fails → Invalid format, line endings, wrong passphrase and server rejection are separate layers. More detail ↓

If → then

An SSH service and a known password, private key or agent context → Use SSH passwords, keys and forwarding-capable access
Needs: Compatible authentication method, correct user, accepted key policy and the requested shell/subsystem permission
SSH reaches a server that can access the needed internal service → Forward a selected service through an SSH client-side listener
Needs: Accepted SSH identity and forwarding policy; local listener availability and SSH-server-to-destination route
A password tied to a plausible user and service → Validate known passwords and context-specific reuse
Needs: Correct local/domain/application identity, reachable compatible service, accepted authentication and account state

No useful finding → another task in this topic. Failed check → resolve the failure before ruling out the path.

Explanation & examples

Inspect and recover SSH private-key access

USE WHEN: A private key from a file read, share, repository or home directory
STARTING ACCESS: A credential artifact with a recorded source and possible account context
RESULT: A usable key and a verified SSH authentication context

Recognize the clue

Trace readable key files from home/configuration/backups to a specific username; inspect the key parser's response before testing the server.

file KEY
ssh-keygen -y -f KEY

SYNTHETIC EXAMPLE OUTPUT

KEY: OpenSSH private key
Enter passphrase for KEY:

Means: The artifact is a private key protected by a local passphrase; this is separate from the SSH account password.

Confirm: Determine the protecting passphrase, associated remote user, accepted algorithm and server key authorization.

After validation: The key parses and the correct server account accepts it: use its permitted shell/subsystem/forwarding capability.
Ruled out in this context: The artifact contains only a public key: reject private-key authentication with that file.
Still inconclusive: A decrypted key rejected by the server leaves username/authorization/policy unresolved.

Troubleshooting: Invalid format, line endings, wrong passphrase and server rejection are separate layers.

Additional prerequisite checks

chmod 600 KEY
ssh-keygen -y -f KEY

Cracking a key passphrase unlocks the file; it does not prove the matching public key is authorized. Permission denied (publickey) can mean wrong user/server, missing authorization or server algorithm/policy after a successful local unlock.

Hashcat variant — only for a supported OpenSSH format

Choose MODE from the complete $sshng$... structure and installed help. Token-length or unsupported-cipher errors require a compatible parser/tool, not --force with a wrong mode.

Why it works

A private-key passphrase protects the file locally; it is not the remote account password. Server acceptance still depends on user, authorized key, ownership and SSH policy.

Worked example · hypothetical

Observation: a key parser requests a passphrase. Test: recover its protection using the linked converter procedure, then authenticate as the evidence-backed user. Illustrative output: the key decrypts but the server rejects that username. Interpretation: revisit account mapping rather than cracking again.

New identity, privilege, host or route? Re-enumerate → All topic tasks →

Study guide ↗Full procedure ↗Cheatsheet ↗